The Agent Skills Directory

[COMMAND_EXECUTION]: The skill utilizes shell commands for media processing and file analysis. Scripts such as bake-basemap.mjs and locate.mjs execute ffmpeg, ffprobe, and base64 via execFileSync and spawnSync to encode video, extract metadata, and process image data.
[EXTERNAL_DOWNLOADS]: The bake-basemap.mjs script retrieves map tiles and styling data from external well-known services including MapLibre, Esri (ArcGIS), and CartoDB. It also downloads geographic TopoJSON data from the world-atlas repository hosted on the jsdelivr CDN.
[INDIRECT_PROMPT_INJECTION]: The skill processes external content from untrusted URLs (web captures, news articles, and tweets) to generate motion graphics. This ingestion of untrusted data creates an attack surface where malicious instructions embedded in the source content could attempt to influence the agent's behavior.
Ingestion points: Untrusted data is ingested during the sourcing phase as described in phases/source/guide.md and categories/webpage/module.md.
Boundary markers: The skill uses a structured shot-plan.json Intermediate Representation (IR) to define content parameters, providing a degree of separation between ingested data and agent instructions.
Capability inventory: The skill has capabilities to execute shell commands (ffmpeg, hyperframes) and perform network operations.
Sanitization: The documentation does not specify explicit sanitization or filtering protocols for text extracted from the captured external content.
[DYNAMIC_EXECUTION]: The bake-basemap.mjs script employs puppeteer-core to launch a headless browser (chrome-headless-shell) for rendering MapLibre GL maps. This involves the dynamic execution of JavaScript from remote CDNs (MapLibre, TopoJSON) within the browser context to generate visual assets.

hyperframes-motion-graphics